Health Research Authority (HRA) response to Draft Direct marketing Code of Practice 
As PECR cover marketing by phone, fax, email, text or any other type of electronic mail, 
communications to inform potential participants about research studies they may be eligible for may 
be considered direct marketing and a GDPR compliant consent would be required for the electronic 
contact. These communications to inform about relevant research project may be made by primary 
care trusts or other NHS organisations and private companies involved in conducting healthcare 
research such a pharmaceutical companies. 


This position is a concern given the efforts in the GDPR (for example in Article 5 1. (b), Article 9 2. (j) 
and Article 89(2) to enable the conduct of scientific research by providing alternatives to consent. 
The wider remit of the Draft Code on Direct Marketing has intensified these concerns. The Draft 
code applies if you process personal data for direct marketing purposes. So the remit is wider than 
PECR and relates to any method of communication which is directed to particular individuals which 
could constitute direct marketing. Other healthcare related examples such as contacting for flu 
vaccines are portrayed as direct marketing in the Draft Code. 


Where PECR applies because the direct marketing communication is electronic the Draft Code 
requires that the basis for processing is the GDPR compliant consent that PECR requires. Where the 
direct marketing communication is not electronic the code recognises that: 


If you are a public authority you might be able to use public task for your direct marketing if 
you can demonstrate that the processing is necessary for a specific task or function set down 
in law 


However, other than indicating that public authorities might be able to rely on Article 6 1. (e) there is 
no more guidance on how they might do this which creates uncertainty for public authorities. The 
Draft Code position in relation to processing of special categories of data and Article 9 is that: 


If you intend to process special category data for direct marketing purposes it is likely that 
the only Article 9 condition available to you will be ‘explicit consent’. Therefore if you do not 
have the individual’s explicit consent you cannot process their special category data for 
direct marketing purposes. 


If contacting individuals in the healthcare sector for anything that falls outside the narrow definition 
of service message and in the wide definition of direct marketing, can only be done on the basis of 
explicit consent under Article 9 2., this may be stifling for healthcare/public health communications. 
We would suggest that such communications should not be termed direct marketing. With regard to 
health research, invitations must be neutral in order to satisfy agreed ethical standards for research, 
so therefore can’t be promotional. If these communications are not direct marketing, processing 
data for the purposes of them should be exempt from the prohibition on bases other than explicit 
consent, such as 9 2. (h), 9 2. (i) and 9 2. (j). 


